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NETWORK INTRUSION DETECTION 
SYSTEM AND METHOD 

ABSTRACT OF THE DISCLOSURE 

A network intrusion detection system comprises a processor and a memory 
accessible by the processor. The system also comprises a monitor application stored 
in the memory and executable by the processor. The monitor application is adapted to 
monitor network activity associated with a network node. The system also comprises 
a profile application stored in the memory and executable by the processor. The 
profile application is adapted to automatically generate an activity profile associated 
with the network node using the monitored network activity. The system further 
comprises a recognition engine stored in the memory and executable by the processor. 
The recognition engine is adapted to compare a network event to the activity profile to 
determine whether the network event is authorized for the network node. 


